Added linux filebeat sensor and template feature for config files

pull/3/head
Thorsten Sick 3 years ago
parent 28b6ffb211
commit f4cdde6776

@ -38,9 +38,16 @@ class BasePlugin():
""" Set the attack logger for this machine """
self.attack_logger = attack_logger
def process_templates(self):
""" A method you can optionally implement to transfer your jinja2 templates into the files yo want to send to the target. See 'required_files' """
return
def setup(self):
""" Prepare everything for the plugin """
self.process_templates()
for a_file in self.required_files:
src = os.path.join(os.path.dirname(self.plugin_path), a_file)
self.vprint(src, 3)
@ -128,10 +135,15 @@ class BasePlugin():
raise NotImplementedError
def get_plugin_path(self):
""" Returns the path the plugin file(s) are stored in """
return os.path.join(os.path.dirname(self.plugin_path))
def get_default_config_filename(self):
""" Generate the default filename of the default configuration file """
return os.path.join(os.path.dirname(self.plugin_path), self.default_config_name)
return os.path.join(self.get_plugin_path(), self.default_config_name)
def get_raw_default_config(self):
""" Returns the default config as string. Usable as an example and for documentation """

@ -0,0 +1,12 @@
# Filebeat plugin
Basic demo plugin for a linux filebeat sensor.
## Important feature
The sensor demos a feature to create config files based on a template before the file is deployed to the target.
## Current state
Basic functionality is working. The logging is not optimized. Will come back to it as soon as we have more attacks.

@ -0,0 +1,19 @@
input {
beats {
port => 5044
}
}
filter {}
output {
file {
path => "{{playground}}/filebeat.json"
codec => json
id => "id_filebeat"
create_if_deleted => true
write_behavior => "append"
}
stdout{}
}

@ -0,0 +1,103 @@
#!/usr/bin/env python3
# A plugin to experiment with Linux logstash filebeat sensors
from plugins.base.sensor import SensorPlugin
import os
import time
from jinja2 import Environment, FileSystemLoader, select_autoescape
class LinuxFilebeatPlugin(SensorPlugin):
# Boilerplate
name = "linux_filebeat"
description = "Linux filebeat plugin"
required_files = ["filebeat.conf",
"filebeat.yml",
]
def __init__(self):
super().__init__()
self.plugin_path = __file__
self.debugit = False
def process_templates(self):
""" process jinja2 templates of the config files and insert own config """
# TODO: Implement
env = Environment(
loader=FileSystemLoader(self.get_plugin_path(), encoding='utf-8', followlinks=False),
autoescape=select_autoescape()
)
template = env.get_template("filebeat_template.conf")
dest = os.path.join(self.get_plugin_path(), "filebeat.conf")
with open(dest, "wt") as fh:
res = template.render({"playground": self.get_playground()})
fh.write(res)
def prime(self):
""" Hard-core install. Requires a reboot """
# For reference: This is the core config we will need. In addition there are two reg files to apply to the registry
# sc control aswbidsagent 255
# timeout /t 5
# 'copy /y "cd %userprofile% & aswidptestdll.dll" "c:\Program Files\Avast Software\Avast\"'
# reg.exe add "HKLM\SOFTWARE\Avast Software\Avast\properties\IDP\Setting" /v debug_channel.enabled /t REG_DWORD /d 1 /f
# timeout /t 2
# sc start aswbidsagent
# Important: AV must be 21.2
# dll_name = self.conf["dll_name"]
# idp_tool_folder = self.conf["idp_tool_folder"]
pg = self.get_playground()
self.vprint("Installing Linux filebeat sensor", 3)
self.run_cmd(f"sudo wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | sudo apt-key add -")
self.run_cmd('sudo echo "deb https://artifacts.elastic.co/packages/7.x/apt stable main" | sudo tee /etc/apt/sources.list.d/elastic-7.x.list')
self.run_cmd("sudo apt update")
self.run_cmd("sudo apt -y install default-jre")
self.run_cmd("sudo apt -y install logstash")
self.run_cmd("sudo apt -y install filebeat")
# Copy config
self.run_cmd(f"sudo cp {pg}/filebeat.yml /etc/filebeat/filebeat.yml")
self.run_cmd(f"sudo cp {pg}/filebeat.conf /etc/logstash/conf.d")
# Cleanup
self.run_cmd(f"rm {pg}/filebeat.json")
self.run_cmd(f"touch {pg}/filebeat.json")
self.run_cmd(f"chmod o+w {pg}/filebeat.json")
return False
def install(self):
""" Installs the filebeat sensor """
return
def start(self):
self.run_cmd("sudo filebeat modules enable system,iptables")
self.run_cmd("sudo filebeat setup --pipelines --modules iptables,system,")
self.run_cmd("sudo systemctl enable filebeat")
self.run_cmd("sudo systemctl start filebeat")
self.run_cmd("sudo systemctl enable logstash.service")
self.run_cmd("sudo systemctl start logstash.service")
return None
def stop(self):
""" Stop the sensor """
return
def collect(self, path):
""" Collect sensor data """
pg = self.get_playground()
self.get_from_machine(f"{pg}/filebeat.json", os.path.join(path, "filebeat.json")) # nosec
Loading…
Cancel
Save